An OS command injection flaw in the COMFAST CF-N1-S management interface allows an authenticated attacker to gain full control of the device.

This is an OS command injection vulnerability triggered by improper sanitization of the ssid argument within the /cgi-bin/mbox-config?method=SET&section=ptest_ssid endpoint. An attacker with administrative privileges can inject arbitrary commands into the underlying operating system.

Successful exploitation results in full system compromise, permitting the attacker to install persistent backdoors, pivot within the internal network, or disrupt critical connectivity services. The high CVSS score of 9.1 reflects the severe impact on confidentiality, integrity, and availability.

Immediate Action: Restrict access to the device management interface to trusted administrative IP addresses only. Contact the vendor for firmware updates, as no explicit patch version is currently identified.

Proactive Monitoring: Monitor device system logs for suspicious command execution patterns or unexpected configuration changes. Audit all administrative activity for unauthorized access.

Compensating Controls: If possible, disable the CGI interface or place the device behind a robust firewall that restricts access to the management console to a dedicated management VLAN.

Public Exploit Available: Yes (a public GitHub repository exists at the cited reference)

Due to the availability of proof-of-concept code and the high potential for full device takeover, this vulnerability poses a severe risk to network infrastructure. Administrators should immediately isolate affected devices from external access until a verified firmware patch is applied.